Virtual machine compliance checking in cloud environments

ABSTRACT

A method of transferring a virtual machine between a virtualized computing system and a cloud computing system includes determining that a virtual machine is to be transferred from a virtualized computing system to a cloud computing system and determining a connection between a first resource in the virtualized computing system and a second resource in the cloud computing system. Files that enable implementation of the virtual machine at the virtualized computing system and identified, as are file portions of the files for transfer from the virtualized computing system to the cloud computing system. At least one compliance check is executed on each of the file portions using at least one compliance checker. Each of the file portions that fails a compliance check is blocked from being maintained in the cloud computing system.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a Continuation of pending U.S. patent applicationSer. No. 15/413,637, filed Jan. 24, 2017 (now U.S. Pat. No. 10,009,368),which is a Continuation of U.S. patent application Ser. No. 14/582,464,filed Dec. 24, 2014 (now U.S. Pat. No. 9,553,887), which claimedpriority from U.S. Provisional Application Ser. No. 62/063,264, filedOct. 13, 2014, which are all incorporated by reference herein in theirentirety.

BACKGROUND

Cloud architectures are used in cloud computing and cloud storagesystems for offering infrastructure-as-a-service (IaaS) cloud services.Examples of cloud architectures include the VMware vCloud™ Directorcloud architecture software, Amazon EC2™ web service, and OpenStack™open source cloud computing service. IaaS cloud service is a type ofcloud service that provides access to physical and/or virtual resourcesin a cloud environment. These services provide a tenant applicationprogramming interface (API) that supports operations for manipulatingIaaS constructs, such as virtual machines (VMs) and logical networks.One operation provided by some services is the transfer to the cloudsystem of VMs on existing computing resources managed by customers. Boththe service provider and the customer perceive risks when uploading VMsto the cloud environment: the customer perceives the risk of potentialloss of sensitive or private data, such as credit card data, personalhealth data, and the like. The service provider perceives the risk ofrunning VMs that contain sensitive data in violation of laws, rules, andregulations, that are unsecure, that are running inauthentic softwarelicensing, and that can potentially compromise the cloud system.

SUMMARY

One or more embodiments provide techniques for virtual machinecompliance checking in cloud environments. In an embodiment, a method oftransferring a virtual machine between a virtualized computing systemand a cloud computing system includes determining that a virtual machineis to be transferred from a virtualized computing system to a cloudcomputing system and includes determining a connection between a firstresource in the virtualized computing system and a second resource inthe cloud computing system. Files that enable implementation of thevirtual machine at the virtualized computing system and identified, asare file portions of the files for transfer from the virtualizedcomputing system to the cloud computing system. At least one compliancecheck is executed on each of the file portions using at least onecompliance checker. Each of the file portions that fails a compliancecheck is blocked from being maintained in the cloud computing system.

Further embodiments include a non-transitory computer-readable storagemedium comprising instructions that cause a computer system to carry outthe above method above, as well as a computer system configured to carryout the above method.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a hybrid cloud computing system in whichone or more embodiments of the present disclosure may be utilized.

FIG. 2 is a block diagram showing an example of a system fortransferring virtual machines between a virtualized computing system anda cloud computing system.

FIG. 3 is a flow diagram showing an example of a method of transferringa virtual machine between a virtualized computing system and a cloudcomputing system.

FIG. 4 is a block diagram depicting an example of a computer system inwhich one or more embodiments of the present disclosure may be utilized.

To facilitate understanding, identical reference numerals have beenused, where possible, to designate identical elements that are common tothe figures. It is contemplated that elements disclosed in oneembodiment may be beneficially utilized on other embodiments withoutspecific recitation.

DETAILED DESCRIPTION

FIG. 1 is a block diagram of a hybrid cloud computing system 100 inwhich one or more embodiments of the present disclosure may be utilized.Hybrid cloud computing system 100 includes a virtualized computingsystem 102 and a cloud computing system 150, and is configured toprovide a common platform for managing and executing virtual workloadsseamlessly between virtualized computing system 102 and cloud computingsystem 150. In one embodiment, virtualized computing system 102 may be adata center controlled and administrated by a particular enterprise orbusiness organization, while cloud computing system 150 is operated by acloud computing service provider and exposed as a service available toaccount holders, such as the particular enterprise in addition to otherenterprises. As such, virtualized computing system 102 may sometimes bereferred to as an on-premise data center(s), and cloud computing system150 may be referred to as a “public” cloud service. In some embodiments,virtualized computing system 102 itself may be configured as a privatecloud service provided by the enterprise.

As used herein, an internal cloud or “private” cloud is a cloud in whicha tenant and a cloud service provider are part of the same organization,while an external or “public” cloud is a cloud that is provided by anorganization that is separate from a tenant that accesses the externalcloud. For example, the tenant may be part of an enterprise, and theexternal cloud may be part of a cloud service provider that is separatefrom the enterprise of the tenant and that provides cloud services todifferent enterprises and/or individuals. In embodiments disclosedherein, a hybrid cloud is a cloud architecture in which a tenant isprovided with seamless access to both private cloud resources and publiccloud resources.

Virtualized computing system 102 includes one or more host computersystems 104. Hosts 104 may be constructed on a server grade hardwareplatform 106, such as an x86 architecture platform, a desktop, and alaptop. As shown, hardware platform 106 of each host 104 may includeconventional components of a computing device, such as one or moreprocessors (CPUs) 108, system memory 110, a network interface 112,storage system 114, and other I/O devices such as, for example, a mouseand keyboard (not shown). Processor 108 is configured to executeinstructions, for example, executable instructions that perform one ormore operations described herein and may be stored in memory 110 and inlocal storage. Memory 110 is a device allowing information, such asexecutable instructions, cryptographic keys, virtual disks,configurations, and other data, to be stored and retrieved. Memory 110may include, for example, one or more random access memory (RAM)modules. Network interface 112 enables host 104 to communicate withanother device via a communication medium, such as a network 122 withinvirtualized computing system 102. Network interface 112 may be one ormore network adapters, also referred to as a Network Interface Card(NIC). Storage system 114 represents local storage devices (e.g., one ormore hard disks, flash memory modules, solid state disks, and opticaldisks) and/or a storage interface that enables host 104 to communicatewith one or more network data storage systems. Examples of a storageinterface are a host bus adapter (HBA) that couples host 104 to one ormore storage arrays, such as a storage area network (SAN) or anetwork-attached storage (NAS), as well as other network data storagesystems.

Each host 104 is configured to provide a virtualization layer thatabstracts processor, memory, storage, and networking resources ofhardware platform 106 into multiple virtual machines 120 ₁ to 120 _(N)(collectively referred to as VMs 120) that run concurrently on the samehosts. VMs 120 run on top of a software interface layer, referred toherein as a hypervisor 116, that enables sharing of the hardwareresources of host 104 by VMs 120. One example of hypervisor 116 that maybe used in an embodiment described herein is a VMware® ESXi™ hypervisorprovided as part of the VMware® vSphere® solution made commerciallyavailable from VMware, Inc. Hypervisor 116 may run on top of theoperating system of host 104 or directly on hardware components of host104.

Virtualized computing system 102 includes a virtualization managementmodule (depicted in FIG. 1 as virtualization manager 130) that maycommunicate to the plurality of hosts 104 via a network, sometimesreferred to as a management network 126. In one embodiment,virtualization manager 130 is a computer program that resides andexecutes in a central server, which may reside in virtualized computingsystem 102, or alternatively, running as a VM in one of hosts 104. Oneexample of a virtualization management module is the vCenter® Serverproduct made available from VMware, Inc. Virtualization manager 130 isconfigured to carry out administrative tasks for computing system 102,including managing hosts 104, managing VMs 120 running within each host104, provisioning VMs, migrating VMs from one host to another host, andload balancing between hosts 104.

In one embodiment, virtualization manager 130 includes a hybrid cloudmanagement module (depicted as hybrid cloud manager 132) configured tomanage and integrate virtualized computing resources provided by cloudcomputing system 150 with virtualized computing resources of computingsystem 102 to form a unified “hybrid” computing platform. Hybrid cloudmanager 132 is configured to deploy VMs in cloud computing system 150,transfer VMs from virtualized computing system 102 to cloud computingsystem 150, and perform other “cross-cloud” administrative task, asdescribed in greater detail later. In one implementation, hybrid cloudmanager 132 is a module or plug-in complement to virtualization manager130, although other implementations may be used, such as a separatecomputer program executing in a central server or running in a VM in oneof hosts 104.

In one embodiment, hybrid cloud manager 132 is configured to controlnetwork traffic into network 122 via a gateway component (depicted as agateway 124). Gateway 124 (e.g., executing as a virtual appliance) isconfigured to provide VMs 120 and other components in virtualizedcomputing system 102 with connectivity to an external network 140 (e.g.,Internet). Gateway 124 may manage external public IP addresses for VMs120 and route traffic incoming to and outgoing from virtualizedcomputing system 102 and provide networking services, such as firewalls,network address translation (NAT), dynamic host configuration protocol(DHCP), load balancing, and virtual private network (VPN) connectivityover a network 140.

In one or more embodiments, cloud computing system 150 is configured todynamically provide an enterprise (or users of an enterprise) with oneor more virtual data centers 170 in which a user may provision VMs 120,deploy multi-tier applications on VMs 120, and/or execute workloads.Cloud computing system 150 includes an infrastructure platform 154 uponwhich a cloud computing environment 170 may be executed. In theparticular embodiment of FIG. 1, infrastructure platform 154 includeshardware resources 160 having computing resources (e.g., hosts 162 ₁ to162 _(N)), storage resources (e.g., one or more storage array systems,such as SAN 164), and networking resources, which are configured in amanner to provide a virtualization environment 156 that supports theexecution of a plurality of virtual machines 172 across hosts 162. It isrecognized that hardware resources 160 of cloud computing system 150 mayin fact be distributed across multiple data centers in differentlocations.

Each cloud computing environment 170 is associated with a particulartenant of cloud computing system 150, such as the enterprise providingvirtualized computing system 102. In one embodiment, cloud computingenvironment 170 may be configured as a dedicated cloud service for asingle tenant comprised of dedicated hardware resources 160 (i.e.,physically isolated from hardware resources used by other users of cloudcomputing system 150). In other embodiments, cloud computing environment170 may be configured as part of a multi-tenant cloud service withlogically isolated virtualized computing resources on a shared physicalinfrastructure. As shown in FIG. 1, cloud computing system 150 maysupport multiple cloud computing environments 170, available to multipleenterprises in single-tenant and multi-tenant configurations.

In one embodiment, virtualization environment 156 includes anorchestration component 158 (e.g., implemented as a process running in aVM) that provides infrastructure resources to cloud computingenvironment 170 responsive to provisioning requests. For example, if anenterprise required a specified number of virtual machines to deploy aweb application or to modify (e.g., scale) a currently running webapplication to support peak demands, orchestration component 158 caninitiate and manage the instantiation of virtual machines (e.g., VMs172) on hosts 162 to support such requests. In one embodiment,orchestration component 158 instantiates virtual machines according to arequested template that defines one or more virtual machines havingspecified virtual computing resources (e.g., compute, networking,storage resources). Further, orchestration component 158 monitors theinfrastructure resource consumption levels and requirements of cloudcomputing environment 170 and provides additional infrastructureresources to cloud computing environment 170 as needed or desired. Inone example, similar to virtualized computing system 102, virtualizationenvironment 156 may be implemented by running on hosts 162 VMwareESX™-based hypervisor technologies provided by VMware, Inc. of PaloAlto, Calif. (although it should be recognized that any othervirtualization technologies, including Xen® and Microsoft Hyper-Vvirtualization technologies may be utilized consistent with theteachings herein).

In one embodiment, cloud computing system 150 may include a clouddirector 152 (e.g., run in one or more virtual machines) that managesallocation of virtual computing resources to an enterprise for deployingapplications. Cloud director 152 may be accessible to users via a REST(Representational State Transfer) API (Application ProgrammingInterface) or any other client-server communication protocol. Clouddirector 152 may authenticate connection attempts from the enterpriseusing credentials issued by the cloud computing provider. Cloud director152 maintains and publishes a catalog 166 of available virtual machinetemplates and packaged virtual machine applications that representvirtual machines that may be provisioned in cloud computing environment170. A virtual machine template is a virtual machine image that isloaded with a pre-installed guest operating system, applications, anddata, and is typically used to repeatedly create a VM having thepre-defined configuration. A packaged virtual machine application is alogical container of pre-configured virtual machines having softwarecomponents and parameters that define operational details of thepackaged application. An example of a packaged VM application is vApp™technology made available by VMware, Inc., of Palo Alto, Calif.,although other technologies may be utilized. Cloud director 152 receivesprovisioning requests submitted (e.g., via REST API calls) and maypropagates such requests to orchestration component 158 to instantiatethe requested virtual machines (e.g., VMs 172).

In the embodiment of FIG. 1, cloud computing environment 170 supportsthe creation of a virtual data center 180 having a plurality of virtualmachines 172 instantiated to, for example, host deployed multi-tierapplications. A virtual data center 180 is a logical construct thatprovides compute, network, and storage resources to an organization.Virtual data centers 180 provide an environment where VM 172 can becreated, stored, and operated, enabling complete abstraction between theconsumption of infrastructure service and underlying resources. VMs 172may be configured similarly to VMs 120, as abstractions of processor,memory, storage, and networking resources of hardware resources 160.

Virtual data center 180 includes one or more virtual networks 182 usedto communicate between VMs 172 and managed by at least one networkinggateway component (e.g., gateway 184), as well as one or more isolatedinternal networks 186 not connected to gateway 184. Gateway 184 (e.g.,executing as a virtual appliance) is configured to provide VMs 172 andother components in cloud computing environment 170 with connectivity toexternal network 140 (e.g., Internet). Gateway 184 manages externalpublic IP addresses for virtual data center 180 and one or more privateinternal networks interconnecting VMs 172. Gateway 184 is configured toroute traffic incoming to and outgoing from virtual data center 180 andprovide networking services, such as firewalls, network addresstranslation (NAT), dynamic host configuration protocol (DHCP), and loadbalancing. Gateway 184 may be configured to provide virtual privatenetwork (VPN) connectivity over a network 140 with another VPN endpoint,such as a gateway 124 within virtualized computing system 102. In otherembodiments, gateway 184 may be configured to connect to communicatewith virtualized computing system 102 using a high-throughput, dedicatedlink (depicted as a direct connect 142) between virtualized computingsystem 102 and cloud computing system 150. In one or more embodiments,gateways 124 and 184 are configured to provide a “stretched” layer-2(L2) network that spans virtualized computing system 102 and virtualdata center 180, as shown in FIG. 1.

While FIG. 1 depicts a single connection between on-premise gateway 124and cloud-side gateway 184 for illustration purposes, it should berecognized that multiple connections between multiple on-premisegateways 124 and cloud-side gateways 184 may be used. Furthermore, whileFIG. 1 depicts a single instance of a gateway 184, it is recognized thatgateway 184 may represent multiple gateway components within cloudcomputing system 150. In some embodiments, a separate gateway 184 may bedeployed for each virtual data center, or alternatively, for eachtenant. In some embodiments, a gateway instance may be deployed thatmanages traffic with a specific tenant, while a separate gatewayinstance manages public-facing traffic to the Internet. In yet otherembodiments, one or more gateway instances that are shared among all thetenants of cloud computing system 150 may be used to manage allpublic-facing traffic incoming and outgoing from cloud computing system150.

In one embodiment, each virtual data center 180 includes a “hybridity”director module (depicted as hybridity director 174) configured tocommunicate with the corresponding hybrid cloud manager 132 invirtualized computing system 102 to enable a common virtualizedcomputing platform between virtualized computing system 102 and cloudcomputing system 150. Hybridity directory 174 (e.g., executing as avirtual appliance) may communicate with hybrid cloud manager 132 usingInternet-based traffic via a VPN tunnel established between gateways 124and 184, or alternatively, using direct connect 142. In one embodiment,hybridity director 174 may control gateway 184 to control networktraffic into virtual data center 180. In some embodiments, hybriditydirector 174 may control VMs 172 and hosts 162 of cloud computing system150 via infrastructure platform 154.

FIG. 2 is a block diagram showing an example of a system 200 fortransferring virtual machines between a virtualized computing system anda cloud computing system. System 200 includes a first resource invirtualized computing system 102 connected to a second resource in cloudcomputing system 150. In the example shown, the first resource compriseshybrid cloud manager 132 and the second resource comprises hybriditydirector 174. The connection between hybrid cloud manager 132 andhybridity director 174 can be made over direct connection 142 or throughnetwork 140 using gateways 124, 184. In one or more embodiments, theconnection between hybrid cloud manager 132 and hybridity director 174may be a trusted connection established using identity verification andencryption techniques known to those skilled in the art.

In an example, hybrid cloud manager 132 includes a VM transfer manager202A and one or more compliance checkers (compliance checker(s) 204A).Hybridity director 174 includes a VM transfer manager 202B. VM transfermanager 202A cooperates with VM transfer manager 202B to transfer VM(s)between virtualized computing system 102 and cloud computing system 150.Hybrid cloud manager 132 can access VM files 206 stored in storagesystem 114. VM files 206 include files that implement VMs 120 invirtualized computing system 102. A given VM can be implemented by a setof files, which can include configuration file(s), virtual disk file(s),virtual disk delta file(s) and configuration file(s) associated with VMsnapshot(s), basic input output system (BIOS) file(s), log file(s), andthe like. VM transfer manager 202A can access VM files 206 in order totransfer a VM. Hybridity director 174 can access a storage system 210 incloud computing system 150 (e.g., storage array network 164). VMtransfer manager 202B can store VM files 208 in storage system 210. VMfiles 208 implement VM(s) that have been transferred from virtualizedcomputing system 102.

In operation, a user can interact with virtualization manager 130,hybrid cloud manager 132, or both to request transfer of a selected VMfrom virtualized computing system 102 to cloud computing system 150.Hybrid cloud manager 132 invokes VM transfer manager 202A to begin thetransfer of the selected VM. VM transfer manager 202A accesses datablocks 207 on storage system 114 that include VM files corresponding tothe selected VM. Data blocks 207 can be logical blocks of a file systemor physical blocks of underlying storage system 114. Alternatively, datablocks 207 can be independent of the file system and storage system 114,where each block includes a sequence of bits or bytes comprising file(s)of VM files 206, or a portion of a file of VM files 206 (e.g., a portionof a virtual disk file). VM transfer manager 202A cooperates with VMtransfer manager 204B to transfer VM files for the selected VM in groupsof sequential groups of data blocks 207, where each group comprises oneor more of data blocks 207.

In an example, before transferring data block(s) over the connection toVM transfer manager 202B, VM transfer manager 202A invokes compliancechecker(s) 204A. Each of compliance checker(s) 204A process datablock(s) to perform a compliance check. A compliance check generallycomprises searching the subject data block(s) for indication(s),satisfying some level of confidence, of specific type(s) of dataconsidered to be non-compliant with a VM transfer policy or VM transferpolicies. For example, an administrator of virtualized computing system102 can establish a VM transfer policy 212, which can be maintained byhybrid cloud manager 132, and which dictates type(s) of data ineligiblefor transfer to cloud computing system 150. An administrator of cloudingcomputing system 150 can establish a VM transfer policy 214, which canbe maintained by hybridity director 174, and which dictates type(s) ofdata ineligible for transfer to cloud computing system 150. In anotherexample, both VM transfer policy 212 and VM transfer policy 214 can beestablished. Hybrid cloud manager 132 can obtain VM transfer policy 214from hybridity director 174, and hybridity director 174 can obtain VMtransfer policy 212 from hybrid cloud manager 132.

Example compliance checks include checking for financial data (financialdata check), checking for human health data (human health data check),checking for unlicensed software (software licensing check), checkingfor malicious software (malicious software check), and checking forsoftware vulnerabilities (software vulnerability check). Financial datacan include, for example, bank account numbers, credit card numbers,financial transaction information, and like type of confidentialfinancial information. Human health data can include, for example,patient records or other types of individually identifiable healthinformation. Malicious software can include computer viruses, worms,malware, and the like. Software vulnerabilities can include un-patchedoperating system files, applications, and the like. In some examples,compliance checks can check for data designated by law, regulation,rule, etc., established by governments, standards bodies, etc., as beingconfidential, proprietary, etc. and subject to specific handling rules.For example, the Payment Card Industry (PCI) Data Security Standard(DSS) defines specific financial data (e.g., credit card information) asbeing subject to specific handling requirements. The Health InsurancePortability and Accountability Act of 1996 (HIPAA) includes a set oflaws enacted in the United States that defines specific electronichealth data as being subject to specific handling requirements.

VM transfer policy 212, VM transfer policy 214, or both can define oneor more compliance checks to be performed during each VM transfer. In anexample, compliance checker(s) 204A check data block(s) before such datablock(s) are transferred to cloud computing system 150. Compliancechecker(s) 204A notify VM transfer manager 202A of data block(s) thatfail a compliance check. VM transfer manager 202A, VM transfer manager202B, or both can take one or more actions, discussed below, in responseto failure of a compliance check performed by compliance checker(s)204A. The action(s) to be taken can be defined by VM transfer policy212, VM transfer policy 214, or both.

In another example, compliance check(s) can be performed by compliancechecker(s) 204B in hybridity director 174. VM transfer manager 202A cantransfer each data block associated with the selected VM, and VMtransfer manager 202B can invoke compliance checker(s) 204B to performcompliance check(s) on data block(s). Compliance checker(s) 204B cannotify VM transfer manager 202B of any data block(s) that fail acompliance check. In still another example, compliance checks can beperformed by both hybrid cloud manager 132 and hybridity director 174.That is, both compliance checker(s) 204A and compliance checker(s) 204Bcan perform compliance check(s). Compliance checker(s) 204A can performdifferent compliance check(s) than compliance checker(s) 204B. One ormore compliance checks can be performed by both compliance checker(s)204A and compliance checker(s) 204B (e.g., redundant compliance checks).This will allow the compliance check criteria to be updated, such asantivirus signatures on the cloud-side as a service.

In general, VM transfer manager 202A, VM transfer manager 202B, or bothprevent each of the data blocks that fails a compliance check from beingmaintained in cloud computing system 150. In an example, VM transfermanager 202A can terminate transfer of the selected VM to cloudcomputing system 150 in response to notification of failed compliancecheck(s) received from compliance checker(s) 204A. VM transfer manager202A can notify VM transfer manager 202B of the termination. In responseto the notification, VM transfer manager 202B can discard any datablock(s) received during the transfer. VM transfer manager 202B cannotify VM transfer manager 202A of failed compliance check(s) indicatedby compliance checker(s) 204B. In response to the notification, VMtransfer manager 202A can terminate the transfer of the selected VM andVM transfer manager 202B can discard any data block(s) received duringthe transfer. Accordingly, embodiments of the present disclosure canpreemptively perform compliance checks of migrating VM files withouthaving to first transfer all data blocks (e.g., the entirety of the VMfiles) to the cloud computing system, which might otherwise wastenetwork bandwidth and network resources.

In another example, rather than terminating the transfer of the selectedVM, VM transfer manager 202A can continue transferring data blocks thatsatisfy the compliance check(s). VM transfer manager 202B can keep datablocks that satisfy the compliance check(s) rather than discarding thedata blocks. VM transfer manager 202B can store the data blocks instorage system 210 to add files of the transferred VM to VM files 208.The VM files of the transferred VM have all data except for the datathat failed the compliance check(s).

In an example, hybridity director 174 can establish a temporary blockstorage 205, which can be implemented on an accessible storage device(e.g., memory in a host having hybridity director 174 or a storagedevice in a host having hybridity director 174 or otherwise accessibleby such host). VM transfer manager 202B can cache data blocks intemporary block storage 205 during transfer of a selected VM. VMtransfer manager 202B can discard data blocks in temporary block storage205 in response to an instruction to do so from VM transfer manager202A. If compliance checker(s) 204B are used, VM transfer manager 202Bcan discard data block(s) that failed a compliance check from temporaryblock storage 205. In this manner, data block(s) that fail a compliancecheck are prevented from being stored in storage system 210 or otherwisebeing used to implement a virtual machine in cloud computing system 150.In response to a completed transfer, VM transfer manager 202B can flushdata blocks in temporary block storage 205 to storage system 210 to addfiles for the selected VM to VM files 208. In another example, temporaryblock storage 205 can be omitted, and VM transfer manager 202B can storedata blocks directly to storage system 210. VM transfer manager 202B candelete data blocks from storage system 210 in case of an instruction todo so from VM transfer manager 202A or in case data block(s) fail acompliance check as indicated by compliance checker(s) 204B.

While hybrid cloud manager 132 is described as having VM transfermanager 202A and compliance checker(s) 204A, hybrid cloud manager 132can have other configurations. In general, the operations performed byVM transfer manager 202A and compliance checker(s) 204A can be performedby one or more modules implemented within hybrid could manager 132, eachof which can include hardware, software, firmware, or a combinationthereof. Likewise, while hybridity director 174 is described as havingVM transfer manager 202B and compliance checker(s) 20B, hybriditydirector 174 can have other configurations. In general, the operationsperformed by VM transfer manager 202B and compliance checker(s) 204B canbe performed by one or more modules implemented within hybriditydirector 174, each of which can include hardware, software, firmware, ora combination thereof.

FIG. 3 is a flow diagram showing an example of a method 300 oftransferring a virtual machine between a virtualized computing systemand a cloud computing system. The method 300 begins at step 302, wherehybrid cloud manager 132 (first resource) establishes a connection tohybridity director 174 (second resource) to transfer files thatimplement a selected VM from virtualized computing system 102 to cloudcomputing system 150. At step 304, hybrid cloud manager 132 accesses,for transmission over the connection, data blocks on storage system 114in virtualized computing system 102 that include VM files for theselected VM. At step 306, hybrid cloud manager 132, hybridity director174, or both execute at least one compliance check on data block(s)using at least one compliance checker (e.g., compliance checker(s) 204A,compliance checker(s) 204B, or both).

At step 308, hybrid cloud manager 132, hybridity director 174, or bothdetermine whether data block(s) fail compliance check(s). Compliancechecks can be performed on one data block at a time, or on a pluralityof data blocks at a time. If the data block(s) pass the compliancecheck(s), method 300 returns to step 304. If the data block(s) fail acompliance check, method 300 proceeds to step 310. Otherwise, hybridcloud manager 132 may proceed to transmit the particular set of datablock(s) to hybridity director 174 at cloud computing system 150. Atstep 310, hybrid cloud manager 132, hybridity director 174, or bothprevent each of the data blocks that fails a compliance check from beingmaintained in cloud computing system 150. For example, at step 312,hybrid cloud manager 132 can block data block(s) that fail compliancecheck(s) from being transmitted over the connection. At step 314,hybridity director 174 can discard data block(s) that fail compliancecheck(s).

At step 316, hybrid cloud manager 132 can determine whether to continuewith the transfer. If so, method 300 returns to step 304. Accordingly,VM transfer manager 202A may validate the integrity of a migrating VM ina streaming fashion, i.e., by checking and transferring data blocks 207in chunks of data block(s) at a time. Otherwise, method 300 proceeds tostep 318. At step 318, hybrid cloud manager 132 terminates transfer ofthe selected VM. At step 320, hybridity director 174 can discard allreceived data blocks. In an example, the decision at step 316 tocontinue the transfer operation can be based on the VM policy 212, theVM policy 214, or both. In another example, the decision at step 316 canbe omitted and method 300 can either always terminate the transfer oralways return to step 304 and continue with the transfer.

FIG. 4 is a block diagram depicting an example of a computer system 400in which one or more embodiments of the present disclosure may beutilized. Computer system 400 can be used as a host to implement hybridcloud manager 132 or hybridity director 174. Computer system 400includes one or more central processing units (CPUs) 402, memory 404,input/output (IO) circuits 406, and various support circuits 408. Eachof CPUs 402 can include any microprocessor known in the art and canexecute instructions stored on computer readable storage, such as memory404. Memory 404 can include various volatile and/or non-volatile memorydevices, such as random access memory (RAM), read only memory (ROM), andthe like. Instructions and data 410 for performing the various methodsand techniques described above can be stored in memory 404 for executionby CPUs 402. That is, memory 404 can store instructions executable byCPUs 402 to perform method 300. Support circuits 408 include variouscircuits used to support operation of a computer system as known in theart.

The various embodiments described herein may employ variouscomputer-implemented operations involving data stored in computersystems. For example, these operations may require physical manipulationof physical quantities—usually, though not necessarily, these quantitiesmay take the form of electrical or magnetic signals, where they orrepresentations of them are capable of being stored, transferred,combined, compared, or otherwise manipulated. Further, suchmanipulations are often referred to in terms, such as producing,identifying, determining, or comparing. Any operations described hereinthat form part of one or more embodiments of the invention may be usefulmachine operations. In addition, one or more embodiments of theinvention also relate to a device or an apparatus for performing theseoperations. The apparatus may be specially constructed for specificrequired purposes, or it may be a general purpose computer selectivelyactivated or configured by a computer program stored in the computer. Inparticular, various general purpose machines may be used with computerprograms written in accordance with the teachings herein, or it may bemore convenient to construct a more specialized apparatus to perform therequired operations.

The various embodiments described herein may be practiced with othercomputer system configurations including hand-held devices,microprocessor systems, microprocessor-based or programmable consumerelectronics, minicomputers, mainframe computers, and the like.

One or more embodiments of the present invention may be implemented asone or more computer programs or as one or more computer program modulesembodied in one or more computer readable media. The term computerreadable medium refers to any data storage device that can store datawhich can thereafter be input to a computer system-computer readablemedia may be based on any existing or subsequently developed technologyfor embodying computer programs in a manner that enables them to be readby a computer. Examples of a computer readable medium include a harddrive, network attached storage (NAS), read-only memory, random-accessmemory (e.g., a flash memory device), a CD (Compact Discs)—CD-ROM, aCD-R, or a CD-RW, a DVD (Digital Versatile Disc), a magnetic tape, andother optical and non-optical data storage devices. The computerreadable medium can also be distributed over a network coupled computersystem so that the computer readable code is stored and executed in adistributed fashion.

Although one or more embodiments of the present invention have beendescribed in some detail for clarity of understanding, it will beapparent that certain changes and modifications may be made within thescope of the claims. Accordingly, the described embodiments are to beconsidered as illustrative and not restrictive, and the scope of theclaims is not to be limited to details given herein, but may be modifiedwithin the scope and equivalents of the claims. In the claims, elementsand/or steps do not imply any particular order of operation, unlessexplicitly stated in the claims.

Virtualization systems in accordance with the various embodiments may beimplemented as hosted embodiments, non-hosted embodiments or asembodiments that tend to blur distinctions between the two, are allenvisioned. Furthermore, various virtualization operations may be whollyor partially implemented in hardware. For example, a hardwareimplementation may employ a look-up table for modification of storageaccess requests to secure non-disk data.

Many variations, modifications, additions, and improvements arepossible, regardless the degree of virtualization. The virtualizationsoftware can therefore include components of a host, console, or guestoperating system that performs virtualization functions. Pluralinstances may be provided for components, operations or structuresdescribed herein as a single instance. Boundaries between variouscomponents, operations and data stores are somewhat arbitrary, andparticular operations are illustrated in the context of specificillustrative configurations. Other allocations of functionality areenvisioned and may fall within the scope of the invention(s). Ingeneral, structures and functionality presented as separate componentsin exemplary configurations may be implemented as a combined structureor component. Similarly, structures and functionality presented as asingle component may be implemented as separate components. These andother variations, modifications, additions, and improvements may fallwithin the scope of the appended claim(s).

We claim:
 1. A method of transferring a virtual machine between avirtualized computing system and a cloud computing system, the methodcomprising: determining connection between a first resource in thevirtualized computing system and a second resource in the cloudcomputing system; accessing, for transmission over the connection, datablocks in the virtualized computing system that include files thatenable implementation of the virtual machine at the virtualizedcomputer; executing at least one policy check on each of the data blocksusing at least one policy checker; and preventing each of the datablocks that fails a policy check from being maintained in the cloudcomputing system.
 2. The method of claim 1, wherein the executing the atleast one policy check on each of the data blocks using at least onepolicy checker is performed by the first resource in the virtualizedcomputing system, and wherein the preventing each of the data blocksthat fails the policy check from being maintained in the cloud computingsystem comprises the first resource blocking each of the data blocksthat fails a policy check from being transmitted over the connection. 3.The method of claim 1, wherein the executing the at least one policycheck on each of the data blocks using at least one policy checker isperformed by the second resource in the cloud computing system, andwherein the preventing each of the data blocks that fails the policycheck from being maintained in the cloud computing system comprises thesecond resource discarding each of the data blocks that fails a policycheck.
 4. The method of claim 1, wherein the executing the at least onepolicy check on each of the data blocks using at least one policychecker is performed partially by the first resource in the virtualizedcomputing system and partially by the second resource in the cloudcomputing system, and wherein the preventing each of the data blocksthat fails the policy check from being maintained in the cloud computingsystem comprises the first resource blocking each of the data blocksthat fails a policy check performed at the first resource from beingtransmitted over the connection and the second resource discarding eachof the data blocks that fails a policy check performed at the secondresource.
 5. The method of claim 1, wherein the at least one policycheck comprises at least one of a financial data check, a human healthdata check, a software licensing check, a malicious software check, or asoftware vulnerability check.
 6. The method of claim 1, wherein theexecuting the at least one policy check on each of the data blocks usingat least one policy checker is performed on at least one plurality ofthe data blocks as a group as the at least one plurality of the datablocks is accessed from the storage device in the virtualized computingsystem at the first resource or received at the second resource in thecloud computing system.
 7. The method of claim 1, wherein the preventingeach of the data blocks that fails a policy check from being maintainedin the cloud computing system comprises at least one of: blockingtransmission of each of the data blocks that fails a policy check overthe connection; or blocking each of the data blocks that fails a policycheck at the second resource from being stored in a resource of thecloud computing system other than the second resource and discardingeach of the data blocks that fails a policy check at the secondresource.
 8. A non-transitory computer readable medium comprisinginstructions, which when executed in a computer system, causes thecomputer system to carry out a method of transferring a virtual machinebetween resources within a hybrid cloud environment, the methodcomprising: determining connection between a first resource in thevirtualized computing system and a second resource in the cloudcomputing system; accessing, for transmission over the connection, datablocks in the virtualized computing system that include files thatenable implementation of the virtual machine at the virtualizedcomputer; executing at least one policy check on each of the data blocksusing at least one policy checker; and preventing each of the datablocks that fails a policy check from being maintained in the cloudcomputing system.
 9. The non-transitory computer readable medium ofclaim 8, wherein the executing the at least one policy check on each ofthe data blocks using at least one policy checker is performed by thefirst resource in the virtualized computing system, and wherein thepreventing each of the data blocks that fails the policy check frombeing maintained in the cloud computing system comprises the firstresource blocking each of the data blocks that fails a policy check frombeing transmitted over the connection.
 10. The non-transitory computerreadable medium of claim 8, wherein the executing the at least onepolicy check on each of the data blocks using at least one policychecker is performed by the second resource in the cloud computingsystem, and wherein the preventing each of the data blocks that failsthe policy check from being maintained in the cloud computing systemcomprises the second resource discarding each of the data blocks thatfails a policy check.
 11. The non-transitory computer readable medium ofclaim 8, wherein the executing the at least one policy check on each ofthe data blocks using at least one policy checker is performed partiallyby the first resource in the virtualized computing system and partiallyby the second resource in the cloud computing system, and wherein thepreventing each of the data blocks that fails the policy check frombeing maintained in the cloud computing system comprises the firstresource blocking each of the data blocks that fails a policy checkperformed at the first resource from being transmitted over theconnection and the second resource discarding each of the data blocksthat fails a policy check performed at the second resource.
 12. Thenon-transitory computer readable medium of claim 8, wherein the at leastone policy check comprises at least one of a financial data check, ahuman health data check, a software licensing check, a malicioussoftware check, or a software vulnerability check.
 13. Thenon-transitory computer readable medium of claim 8, wherein theexecuting the at least one policy check on each of the data blocks usingat least one policy checker is performed on at least one plurality ofthe data blocks as a group as the at least one plurality of the datablocks is accessed from the storage device in the virtualized computingsystem at the first resource or received at the second resource in thecloud computing system.
 14. The non-transitory computer readable mediumof claim 8, wherein the preventing each of the data blocks that fails apolicy check from being maintained in the cloud computing systemcomprises at least one of: blocking transmission of each of the datablocks that fails a policy check over the connection; or blocking eachof the data blocks that fails a policy check at the second resource frombeing stored in a resource of the cloud computing system other than thesecond resource and discarding each of the data blocks that fails apolicy check at the second resource.
 15. A computer system, comprising:a memory configured to store code; and a processor configured to executethe code to: determine connection between a first resource in avirtualized computing system and a second resource in a cloud computingsystem; access, for transmission over the connection, data blocks in thevirtualized computing system that include files that enableimplementation of the virtual machine at the virtualized computer;execute at least one policy check on each of the data blocks using atleast one policy checker; and prevent each of the data blocks that failsa policy check from being maintained in the cloud computing system. 16.The computer system of claim 15, wherein the at least one policy checkcomprises at least one of a financial data check, a human health datacheck, a software licensing check, a malicious software check, or asoftware vulnerability check.
 17. The computer system of claim 15,wherein the processor executes the code to execute the at least onepolicy check on each of the data blocks as each of the data blocks isaccessed from a storage device in the virtualized computing system. 18.The computer system of claim 15, wherein the processor executes the codeto execute the at least one policy check on at least one plurality ofthe data blocks as a group as the at least one plurality of the datablocks is accessed from a storage device in the virtualized computingsystem.
 19. The computer system of claim 15, wherein the processorexecutes the code to prevent each of the data blocks that fails a policycheck from being maintained in the cloud computing system by blockingtransmission of each of the data blocks that fails a policy check overthe connection.